Splunk Splunk Certifications SPLK-3003 Questions & Answers

• Question 41:

  A customer has a number of inefficient regex replacement transforms being applied. When under heavy load the indexers are struggling to maintain the expected indexing rate. In a worst case scenario, which queue(s) would be expected to fill up?

  A. Typing, merging, parsing, input

  B. Parsing

  C. Typing

  D. Indexing, typing, merging, parsing, input

  Correct Answer: B

• Question 42:

  A new single-site three indexer cluster is being stood up with replication_factor:2, search_factor:2. At

  which step would the Indexer Cluster be classed as `Indexing Ready' and be able to ingest new data?

  Step 1: Install and configure Cluster Master (CM)/Master Node with base clustering stanza settings,

  restarting CM.

  Step 2: Configure a base app in etc/master-apps on the CM to enable a splunktcp input on port 9997 and

  deploy index creation configurations.

  Step 3: Install and configure Indexer 1 so that once restarted, it contacts the CM, download the latest

  config bundle.

  Step 4: Indexer 1 restarts and has successfully joined the cluster.

  Step 5: Install and configure Indexer 2 so that once restarted, it contacts the CM, downloads the latest

  config bundle

  Step 6: Indexer 2 restarts and has successfully joined the cluster.

  Step 7: Install and configure Indexer 3 so that once restarted, it contacts the CM, downloads the latest

  config bundle.

  Step 8: Indexer 3 restarts and has successfully joined the cluster.

  A. Step 2

  B. Step 4

  C. Step 6

  D. Step 8

  Correct Answer: A

• Question 43:

  A customer wants to migrate from using Splunk local accounts to use Active Directory with LDAP for their Splunk user accounts instead. Which configuration files must be modified to connect to an Active Directory LDAP provider?

  A. authentication.conf, authorize.conf, ldap.conf

  B. authentication.conf, ldap.conf

  C. authentication.conf

  D. authorize.conf, authentication.conf

  Correct Answer: C

  Reference: https://docs.splunk.com/Documentation/Splunk/8.1.0/Security/ ConfigureLDAPwithconfigurationfiles

• Question 44:

  A customer would like Splunk to delete files after they've been ingested. The Universal Forwarder has read/write access to the directory structure. Which input type would be most appropriate to use in order to ensure files are ingested and then deleted afterwards?

  A. Script

  B. Batch

  C. Monitor

  D. Fschange

  Correct Answer: B

  Reference: https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-have-a-Splunk-universalforwarder-read-a/td-p/172752

• Question 45:

  In which directory should base config app(s) be placed to initialize an indexer?

  A. $SPLUNK_HOME/etc/

  B. $SPLUNK_HOME/etc/apps

  C. $SPLUNK_HOME/etc/system/local

  D. $SPLUNK_HOME/etc/slave-apps

  Correct Answer: B

  Reference: https://docs.splunk.com/Documentation/Splunk/8.1.0/Indexer/Manageappdeployment

• Question 46:

  As a best practice which of the following should be used to ingest data on clustered indexers?

  A. Monitoring (via a process), collecting data (modular inputs) from remote systems/applications

  B. Modular inputs, HTTP Event Collector (HEC), inputs.conf monitor stanza

  C. Actively listening on ports, monitoring (via a process), collecting data from remote systems/applications

  D. splunktcp, splunktcp-ssl, HTTP Event Collector (HEC)

  Correct Answer: B

• Question 47:

  When adding a new search head to a search head cluster (SHC), which of the following scenarios occurs?

  A. The new search head connects to the captain and replays any recent configuration changes to bring it up to date.

  B. The new search head connects to the deployer and replays any recent configuration changes to bring it up to date.

  C. The new search head connects to the captain and pulls the most recently deployed bundle. It then connects to the deployer and replays any recent configuration changes to bring it up to date.

  D. The new search head connects to the deployer and pulls the most recently deployed bundle. It then connects to the captain and replays any recent configuration changes to bring it up to date.

  Correct Answer: C

• Question 48:

  In which of the following scenarios is a subsearch the most appropriate?

  A. When joining results from multiple indexes.

  B. When dynamically filtering hosts.

  C. When filtering indexed fields.

  D. When joining multiple large datasets.

  Correct Answer: A

• Question 49:

  A customer has implemented their own Role Based Access Control (RBAC) model to attempt to give the Security team different data access than the Operations team by creating two new Splunk roles ?security and operations. In the srchIndexesAllowed setting of authorize.conf, they specified the network index under the security role and the operations index under the operations role. The new roles are set up to inherit the default user role.

  If a new user is created and assigned to the operations role only, which indexes will the user have access to search?

  A. operations, network, _internal, _audit

  B. operations

  C. No Indexes

  D. operations, network

  Correct Answer: A

• Question 50:

  What is the default push mode for a search head cluster deployer app configuration bundle?

  A. full

  B. merge_to_default

  C. default_only

  D. local_only

  Correct Answer: B

  Reference: https://docs.splunk.com/Documentation/Splunk/8.1.0/DistSearch/ PropagateSHCconfigurationchanges#:~:text=The%20deployer%20push%20mode%20determines,default %20push%20mode%20is%20merge_to_default%20